samba - Mar 2015 - Joining a domain

On Thu, Mar 12, 2015 at 2:25 AM, Rowland Penny
<rowlandpenny at googlemail.com> wrote:
>> I'm sorry for being so daft, but I am asking you if I need/want to
>> join the domain.  I do not know the answer.  Reminder of my scenario:
>> samba is sharing files and users provide their Active Directory
>> usernames and passwords to log into to samba.  I will call this
>> "Scenario A".
>>
>
> If you want to use usernames & passwords then you can do this at least
two
> ways:
> A) create all the required users on the computer and run it as a standalone
> server
> B) join the computer to the domain and use the DC's for authentication
Thank you for educating me.

I have my samba setup working as you have described, but I will ask a
question for "academic" purposes -- just so I can better understand
what is happening.  Please feel free to refer me to a
book/site/article/source_code that spells out what is happening.

Couldn't samba act as a "proxy", not join the windows domain, but
still authenticate via AD?

1. samba shares files without joining AD.

2. A user "logs in" to samba by presenting an AD username/password

3. samba, not being joined to the domain still finds a "domain
controller" and submits the credentials.

4. the "domain controller" responds PASS or FAIL

5. samba allows access as appropriate, perhaps mapping to a valid UID

I am trying to understand what is happening, I am not trying to insult
samba or it's code or its way of doing things.

Thank you,

Chris

On 12/03/15 16:39, Chris Stankevitz wrote:
> On Thu, Mar 12, 2015 at 2:25 AM, Rowland Penny
> <rowlandpenny at googlemail.com> wrote:
>>> I'm sorry for being so daft, but I am asking you if I need/want
to
>>> join the domain.  I do not know the answer.  Reminder of my
scenario:
>>> samba is sharing files and users provide their Active Directory
>>> usernames and passwords to log into to samba.  I will call this
>>> "Scenario A".
>>>
>> If you want to use usernames & passwords then you can do this at
least two
>> ways:
>> A) create all the required users on the computer and run it as a
standalone
>> server
>> B) join the computer to the domain and use the DC's for
authentication
> Thank you for educating me.
>
> I have my samba setup working as you have described, but I will ask a
> question for "academic" purposes -- just so I can better
understand
> what is happening.  Please feel free to refer me to a
> book/site/article/source_code that spells out what is happening.
>
> Couldn't samba act as a "proxy", not join the windows domain,
but
> still authenticate via AD?
No, to authenticate via AD, it has to be an AD member.
>
> 1. samba shares files without joining AD.
>
> 2. A user "logs in" to samba by presenting an AD
username/password
This user would then be an unknown user and 'map to guest = Bad User' 
would then be needed to allow the unknown user to connect.
>
> 3. samba, not being joined to the domain still finds a "domain
> controller" and submits the credentials.
If the computer is not joined to the domain, it may be able to find a 
DC, but it would not be able to connect to it for authentication.
> 4. the "domain controller" responds PASS or FAIL
It would respond 'FAIL'
> 5. samba allows access as appropriate, perhaps mapping to a valid UID
Samba would not allow access, unless 'security = user' & 'map to
guest =
Bad User' are both set in smb.conf.
> I am trying to understand what is happening, I am not trying to insult
> samba or it's code or its way of doing things.
I didn't think you were, I just thought you were asking very basic 
questions.

Rowland
> Thank you,
>
> Chris

On Thu, Mar 12, 2015 at 9:59 AM, Rowland Penny
<rowlandpenny at googlemail.com> wrote:
> I didn't think you were, I just thought you were asking very basic
> questions.
Thank you.  If you know of a source that explains these details,
please please tell me what it is and I will happily read it:

1. samba must be joined to the domain in order to authenticate AD
users.  Never mind your experience accessing a Windows AD share from
your mac/linux/windows computers that are not joined to the domain.

2. When a samba machine is joined to the domain, that information is
written to secrets.tdb and can be queried using "net ads testjoin"

Chris